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Abstract 

Introduction. A significant part of the global and state economy is the production and supply of hydrocarbon raw 
materials. The issues of safety in this area will remain important in the coming decades. The problem is actively 
discussed in the professional and scientific community. Theoretical and applied works are published. Local, point-based 
methods are calculated and implemented, which allow predicting and preventing emergencies in certain units of the 
considered objects. At the same time, there are no sufficiently justified and reproducible system solutions that can take 
into account the state of, for example, oil or gas field as a single complex and act as indicators not only of ordinary local 
accidents, but also of systemic accidents — catastrophes. Such a scientifically and experimentally based solution is 
described in this article. The approach is proposed as part of the formation of a comprehensive scientific and technical 
program (CSTP) to ensure the safety of natural and technogenic objects (NTO). The aim of this work was to describe 
the practice of its application in the conditions of specific gas fields and to justify the refusal to focus on solutions that 
took into account only the minimum practically acceptable risk, that is, built on the ALARP principle (as low as 
reasonably practicable). 

Materials and Methods. The article was based on the results of field tests of natural and technogenic objects (NTO) of 
the oil and gas complex — the Yuzhno-Russkoye field of OJSC Severneftegazprom (SNGP), LLC Gazprom Dobycha 
Yamburg (GDYA) and the gas pumping station (GPS) Orlovka-2 (Ukraine), conducted with the authors’ participation. 
Significant results were obtained and evidence-based physically interpreted during acceptance tests of an explosion- 
proof certified, created under the guidance of the authors of a prototype of a disaster response system (DRS) at the 
integrated gas treatment plant (IGTP) in LLC GDYA in 2006. At the same time, for the first time in the world practice, 
the fact of early detection and parrying without consequences by means of DRS on the UKPG-2 of the development of 
a large-scale general industrial disaster was confirmed. 

In the form of graphs, the revealed patterns of NTO have been visualized, which made it possible to form harbingers of 
the development of accidents and catastrophes at the NTO of LLC "GDYA", SNGP and GPS "Orlovka-2". Information 
on the high experimental reproducibility of the obtained results was presented. 

The technology has been developed of early detection and parrying of all types of potentially dangerous self-exciting systemic 
phenomena on real NTO infrastructure — self-oscillations. Three cases of their excitation in real gas fields were presented. 
Results. The paper shows the fragmentary nature and locality of emergency protection systems based on the ALARP 
principle. The consequence of this was its complete unsuitability for early detection and counteraction to the most large- 
scale and costly system accidents — catastrophes that were multifactorial processes, in which none of the factors was 
decisive. The alternative complex solution of the problem proposed by the authors and brought to working condition 
was based on a system approach adapted to the NTO of the oil and gas complex. 

The measured parameters of various NTO infrastructure — fields of LLC "GDYA" and SNGP were processed and 
analyzed at the moments of development of self-oscillating modes on them, due to self-sustaining nonlinear 
mechanisms of interaction of NTO elements with constant (non-oscillatory) sources of energy replenishment. Three 
such modes of self-excitation were illustrated. The most informative in this case were the transient modes of operation 
of the equipment. 


© Deduchenko FM, Dmitrievsky AN, 2023 


Technosphere Safety 


55 


https://bps-journal.ru/ 


56 


Safety of Technogenic and Natural Systems. 2023 ;7(4):55—69. eISSN 2541-9129 


According to the technologies experimentally developed by the authors, the areas of critical operating modes of 
equipment with pronounced potentially dangerous bifurcation points were analyzed. The result of superimposing 
treatments of the measured parameters of eight full-scale tests of NTO — graphs of dimensionless amplitude-frequency 
characteristics of the interconnections of a real dynamic system was presented: "input — gas cooling housing" > 
"output — pipe casing" at the frequency of self-oscillations. 

Discussion and Conclusion. The capabilities of ALARP did not meet the tasks of system monitoring of the occurrence 
and development of dangerous incidents in gas fields. This conclusion can be attributed to all standard sizes of NTO 
infrastructure in Russia. Fundamentally different solutions should be used to ensure comprehensive observability, 
controllability, and safety of NTO. A comprehensive scientific and technical program is recommended: "Innovative 
hardware and software tools and technologies to ensure the observability, controllability, and safety of the NTO 
infrastructure of Russia". 


Keywords: natural-technogenic object, ALARP principle, safety of oil and gas fields, development of a system 
accident, counteraction to the development of accidents 


Acknowledgements. The authors would like to thank the editorial board and the reviewers for their attentive attitude to 
the article and for the specified comments that improved the quality of the article. 


For citation. Deduchenko FM, Dmitrievsky AN. Ensuring Safety of Gas Field Infrastructure Using ALARP and a 
Systematic Approach. Safety of Technogenic and Natural Systems. 2023;7(4):55—69. 
https://doi.org/10.23947/2541-9129-2023-7-4-55-69 


Hayunaa cmamoa 


Odecneuenne Ges0nacHOcTH HHpacrpyKTypbi ra30BbIX MecTOPOXKAeCHHH CpeqcTBaMH 
ALARP i cncTemHoro noyzXxoya 


@.M. Jenyuenko &, A.H. Imurpnescknit 
VUxctutyt mpo6sem Hedtu vu ra3a Poccniickoli akayjemun Hayk, r. Mocxsa, Poccniickaa Deyepanna 


DX] fmd11@mail.ru 


AnnoTayna 

Beedenue. 3HauumMy!O 4acTb MMpoBOH HM YTocyapcTBeHHOM 9OKOHOMMKH COCTaBsIdeT oOnMa HM NOcTaBKa 
yreBOAOpOAHOrO cbhipba. AKTyaJIBHOCTb BOTIpOCoB Oe30MacHOCTH B STOM cibepe coxpaHHTca B TeyeHMe OpKaMIHXx 
qecatuneTui. IpoOsmema akTHBHO oOcyxKyaeTcaA B UpodeccHoHaIbHOM HM Hay4Hom coobmectBe. Ily6nuKyrotca 
TeopeTHYecKHe HM MpuKsaqHble padotsi. [pocuntTprBparoTcaA HU BHEPAIOTCA JIOKaJIbHbIe, TOUCUHbIC METOLbI, KOTOPIe 
MO3BOJIAIOT TIpeACKa3bIBaTb HW TipesyipexaTh aBapviiHble CHTyalMu B OMpeeseHHbIX y3slaxX PaCCMaTPHBaeMBIxX 
oOsbexTos. IIpu 3TOM HeT AOCTaTOUHO OOOCHOBaHHBIX HM BOCIPOM3BO]MMBIX CHCTeMHBIX PeLIeHH, CiHOCOOHBIX 
YUHTBIBATh COCTOAHMe, HallpHMep, HedPTAHOrO WIM Ta30BOrO MpOMBbICIa KaK €HHOrO KOMIVIeKca HM BbICTyMaTb 
WH]MKaTopaMu He TOJIbKO OOBISHBIX JIOKAIbHBIX aBapHii, HO H CHCTeMHbIX aBapHii — KaTacTpod. Takoe HayyHo 
3KCICPHMeHTaIbHO OOOCHOBaHHOe pellieHHe onMcaHO B TpeycTaBseHHou ctaTbe. Tloxxoq mpeaoKeH B paMKax 
(OpMupoBaHHA KOMIVIeCKCHOM HayyHO-TexHuYecKoH MporpamMMpl (KHTII) o6ecneyenua Oe3zonacHocTu UpuposHo- 
TEXHOreHHBIX OOBeKTOB (IITO). Leb pabotpl — onucaTb WpakTHuKy ero MpHMeHeHHA B YCOBHAX KOHKPeTHBIX 
Ta30BbIX IIPOMBICJIOB H OOOCHOBaATb OTKa3 OT OPHeHTAalHH Ha PeWICHHA, YYHTbIBAIOWIHe TOJIbKO MHMHMMaJIbHbI 
TipakTHYecKH IPHeMJIeMbIM PUCK, TO eCTb HoOcTpoeHHbIe mo mpHHyumy ALARP (aura. as low as reasonably 
practicable). 

Mamepuanei u memoodoi. UcxoyHbiMy [iA CTATbM CTaJIM pe3yIbTAaTbI MPOBeCHHbIX C yY4YaCTHeM aBTOPOB HaTypHbIx 
MCIbITaHHH += MpHpOAHO-TexHoreHHBIX oObeKToB (IITO) xHedtera3oporo Kommiexca — I[OxxHo-Pycckoro 
MecTopoxyeHua OAO «CesBepHedtera3npom)» (CHIT), OOO «fa3npom yoodsrma Amoypr» («lA») u 
ra3onepekaynBaiomjen ctanuuu (IIIA) «OpnosKa-2» (YkpanHa). 3HayuMbIe pe3ysIbTaTbI MOJYYeHbI U WOKazaTeIbHO 
(pu3H4eCKH MHTepIpeTUpOBAaHbI IPH MpHeMO-caTOUHBIX HCIIbITAHHAX CepTHPHUMPOBaHHOrO Ha B3pPbIBOOe30MAaCHOCTE, 
CO34aHHOrO TO, PyKOBOACTBOM aBTOPOB MIpOTOTHHa CHCTeMbI IIPOTHBOLelCTBHA pa3sBHTMIO KatTactpod (CIIPK) ua 
yCTaHOBKke KOMIWIeKCHOM nmogroTosKu ra3a (YKIIT) 8 OOO «A B 2006 rogy. [pu stom sBnepBbie B MupoBolt 
TipakTHKe ObiI akKTHpoBaH (akT paHHero OOHapy2KeHHA MH MapHpoBaHuaA Oe3 NocreycTBMHM cpeacTBamMu CIIPK na 
YKIT-2 passutua MacwitTaOHon OOMIeMpoMBICIOBOM KaTacTpodsl. 
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B Buye rpadvkKoB BH3yaIM3HpOBaHbI BBbIABJICHHbIe 3akKOHOMepHOocTH IITO, no3BomMBuIMe ciopMHpoBaTb 
TIpeABeCTHHKH pa3BHTHA aBapult Hu Katactpo* Ha IITO OOO «IA», CHIH u TMC «Opnosxa-2». peazctapnena 
WHPOpMallHA O BLICOKOM SKCIHEPHMCHTAJIbHOM BOCIIPOH3BOAMMOCTH HOJIYYCHHBIX Pe3YJIbTATOB. 

OtpaOoTaHa TexHOJIOrHa paHHero oOOHapyxKeHHA HM WapHpoBaHHa BCeX THIOB MOTCHUMaIbHO OMMaCHbIx 
CaMOBO30y2KTaIOWIMXCA CHCTEMHBIX ABJICHHM Ha peabubix IITTO undpactpyktyppi — apToxonedannn. Mpeyctapnenbi 
TPH CILyyad HX BO3Oy2KTCHHA Ha PeasIbHBIX Ta30BbIX IIPOMBICAX. 

Pezynomamet uccnedoeanua. (Vloxa3aHa (bparMeHTapHOCTb MM JIOKasIbHOCTb CHCTeM aBapHiiHol 3ammuTpr ITO, 
Oa3Hpyromluxca Ha pHuyune ALARP. CneyqcTBuem 9Toro cTalla ero NOJIHat HeMpHroJHOCTh id paHHero oOHapy2KeHHA V1 
MIPOTHBOJeHCTBHA CAMOOpraHH30BaHHO BO3Oy2KTaIOWMMcA HanOouee MacluITaOHbIM M 3aTpaTHbIM CHCTeMHbIM aBapiaM — 
KaTacTpotbaM, IpecTaBIAIOWMM coOol Mpoleccbl MHOrodakTOpHbie, HH OJMH H3 :akKTOPOB B KOTOPbIX He ABIJIAeTCA 
onpeyesronuM. ITpezioxkeHHoe aBropaMH MM WOBeeHHOe WO padouero COCTOAHMA aJIbTepHATHBHOe KOMIVICKCHOe pellieHHe 
TIpoOsiemb! Oa3snpyetcs Ha aanTupoBaHHom K ITTO Hedtera30Boro KOMIIeKca CHCTEMHOM TO Axoye. 

OopaOotaHbI HM MpoaHaM3upoBaHbl H3MepsAeMble apaMetpsl pa3sHBIx IITO uadpactpyKTypbl — mpompics0s OOO 
«iA» wu CHIIL B MomeHTEI pa3BHTHd Ha HUX aBTOKONeOaTeIbHBIX PpeXKHMOB, OOYCJIOBJICHHBIX 
CaMONOJepoKHBalOWMMUCA HeMHeMHbIMH MeXaHv3MaMM B3aHMMOelcTBua 9eMeHTOB IITO c nocTosHHBIMH (He 
KOJIeOaTesIbHbIMH) HCTOUHNKaMH BOCHONHeHHA 9Hepruu. [[pousrocTpHpoBaHo TpH TaKHX pexkHMa CaMOBO30y7KeHHA. 
HanOosee nHopMaTHBHBIMH Ip 3TOM OKa3asIMCb MepexOHble pexKUMbI padoTE! OOopyA0BaHHA. 

Ilo sKcMepHMeHTaIbHO OTpaOoTaHHbIM aBTOpaMH TeXHOJIOrHAM ObWIM WpoanaM3HpOBaHbI OOacTH KPpHTHYeCKHX 
pexkuMoB padoTs! obopyyOBaHHA C BbIPaKeHHbIMH MOTeHUMaIbHO OMacHbIMH TOUKaMH OudypKaunu. IIpexctapex 
pe3yIbTaT HaloxKeHHA OOpaOoTOK W3MepAeMBIX TlapaMeTpOB BOCbMHM HaTypHbIX ucnbitanui IITO — rpaduxos 
Oe3pa3MepHBIX aMIVIMTYHO-YaCTOTHBIX XapaKTepHCTHK B3aHMOCBA3eH PeaIbHOM JWHAaMMYeCKOM CHCTeMBI: «BXO — 
KOpllyc oxlaKeHuA ra3ay» — «BbIXOA — TpyOHas OOB13Ka Koprlyca» Ha YacTOTe aBTOKOJIeOaHHH. 

O6cystcOenue u 3akni0“enue. BosMoxHocTH ALARP He OTBeuaIOT 3aa4aM CHCTEMHOTO MOHMTOPHHTa BO3HUKHOBCHHA 
Pa3BHTHA OMAaCHbIX MHUMeCHTOB Ha Ta30BbIX MeCTOPOXKJCHHAX. OTOT BbIBO], MOXKHO OTHECTH KO BCeM THMOpa3sMepaM 
IITO undpactpyxtypsr Poccnu. Ja oOecneseHud KOMIVIeKCHOM HaOsOMaeMOCTH, yiIpaBsAeMocTH, Oe30lacHoOcTH 
3anquiyeHHoctTn IITO cnezyeT 3afelicTBOBaTb MIpHHUMMHaIbHO MHbIe pelieHus. PexoMeHyOBaHa KOMIIIeKCHad HaydHo- 
TexHwyeckad rmporpamMa: «MHHOBaI[MOHHBbIe MporpaMMHO-alinapaTHble cpeJCTBa HW TeXHOJOrHH B ObecTIeYeHHe 
HaOJIOaeMOCcTH, yupaBsItemocTH, OesonacHoctTu IITO undpactpyktyppi Poccum». 


Kiroveevie caoea: ttpupodHo-TexHoreHHbli OObeKT, UpHHuuM ALARP, Oe3sonacHocTb HedTera30BbIX TPOMBICJIOB, 
pa3BUTHe CHCTeMHOM aBapHu. MpoTHBOAeHCTBHe pa3sBUTHIO aBapHii 


Baarojapuoctn. ABTOpBI BbIparxKaroT OnaroyapHOcTb pewqakKwMv WU peneH3eHTaM 3a BHHMAaTCJIbHOe OTHOMICHHe K 
CTaTbe HW YKa3aHHble 3aMedaHHA, KOTOPbIe NO3BOJINJIN MOBbICHTb Ce KadeCcTBO. 


Aaa uuTupopanua. Jlegyyenxo ©.M., J[mutrpuescxui A.H. OOecneyenue Oe30nacHocTu MHdpacTpyKTypbI Ta3s0BbIx 
MecTopoxyeHHi cpeyctBamMu ALARP u cucTtemHoro mogxoga. besonacnocmb mexnozenHolx u npupooHelx cucmem. 
2023;7(4):55—69. https://doi.org/10.23947/2541-9129-2023-7-4-55-69 


Introduction. According to the Center for Research on the Epidemiology of Disasters (CRED), almost all large- 
scale system accidents are recorded post factum. This indicates a significant amount of work and efforts that are needed 
to ensure safety of natural and man-made facilities [1]. It should be emphasized that in this case, safety is a systemic 
(integral) nonlinear quality of a complex system. Scientific research in this area involves, in particular, the revision of 
stable stereotypes. One of them is the statement that the parts determine the properties of the entire object (including 
safety). It should be recognized that this theoretical approach (in some cases justified) does not find practical 
confirmation when it comes to the problems considered in the framework of this study. Not only the risks of epidemics 
and man-made disasters are growing in the world, but also the implementation of the worst scenarios and the enormous 
losses associated with them. The experience of recent years proves an extremely low awareness of the features of such 
processes and the inability to influence them. 

The first full-fledged emergency protection systems in the world practice were created in Russia in the 50s and 60s 
of the last century. Their authors were specialists in rocket space engines. In the 1970s and 2010s, as part of the 
conversion, civil industries were able to use these unique achievements to solve safety problems of complex general 
technical infrastructure facilities. First of all, the developments were used at nuclear and thermal power facilities, in the 
oil and gas complex, and aviation. In the circumstances concerned in 1995, on the initiative of the NPO Energomash 
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named after V.P. Glushko, the authors of the presented article formed an interdepartmental working group of the 
Russian Academy of Sciences. In 2014, it was legalized by the decision of the All-Russian Research Institute for Civil 
Defense and Emergency Situations of the Ministry of Emergency Situations of Russia (Federal Center for Science and 
High Technologies). 


The group took part in the works listed below. 

1. In 2006, for the first time in world practice, a system was created that was certified for explosion safety and 
allowed to counteract the development of a real large-scale industrial disaster. 

2. In 2016, a Strategy for countering the development of disasters was developed and defended. 

3. In 2017, on behalf of the President of the Russian Academy of Sciences, the strategy "Innovative technologies 
and means of protection against man-made accidents at industrial infrastructure facilities in Russia" was formed, 
scientifically and experimentally substantiated, and defended. 

4. In 2021, a Comprehensive Scientific and Technical Project (CSTP) of the full innovation cycle "Innovative 
software and hardware and technologies to ensure the observability, controllability, and safety of the NTO infrastructure 
of Russia" was created, scientifically and experimentally substantiated, and defended. 

We should emphasize that the formulation of the problem and the technologies focused on its solution were the 
result of work first on the Concept (on the instructions of the leadership of the All-Russian Research Institute for Civil 
Defense and Emergency Situations of the Ministry of Emergency Situations of Russia), and then on the Strategy of the 
Russian Federation to counter the development of Disasters (by the decision of the Presidium of the Russian Academy 
of Sciences). 

From the point of view of safety, one of the essential non-linearities of complex multicomponent infrastructure 
objects is a violation of the superposition principle. The fact is that the safety of the NTO is not determined by the state 
and functioning of its constituent elements! * > 4, 

Nevertheless, in the real conditions of NTO operation, the world practice remains, as it was 100 years ago, 
traditional, that is, locally oriented. It is based on the erroneous principle that the NTO is safe if all its elements are safe. 
This is due to the almost complete loss of control of man-made disasters, which on average are 4-5 orders of magnitude 
more costly in terms of consequences compared to local accidents in the NTO elements. Only in recent decades it has 
been possible to understand, scientifically and experimentally substantiate the physical mechanisms governing such 
incidents [1—4]. 

It should be noted that an application is ready for the development of a full innovation cycle CSTP "Creation of 
innovative software and hardware and technologies to ensure the observability, controllability and safety of natural and 
man-made infrastructure facilities in Russia". The project is focused on the creation of breakthrough domestic 
technologies to increase the competitiveness of the economy in compliance with the provisions of the basic documents 
of Russia's strategic development. The application has been approved for submission to the Council for Priority Areas 
of Scientific and Technological Development of the Russian Federation. As a result, within the framework of the all- 
Russian strategy, a unified system of natural and man-made security (USNMS) of the infrastructure of Russia will be 
created [1, 5, 6]. 

The aim of the work was to describe a new practice implemented in the conditions of a specific gas field and to 
justify the refusal to focus on solutions that take into account only the minimum practically acceptable risk, that is, built 
on the principle of ALARP (as low as reasonably practicable). Let us clarify that the promising, global goal of the 
authors! scientific and applied research, including those described in this article, was to create, within the framework of 
the Strategy of the Russian Federation, an object-oriented unified system of natural and man-made security (USNMS) 
of the infrastructure of Russia, an alternative output according to the ALARP ideology. 

According to Rostekhnadzor of the Russian Federation, during the transportation of liquid and gaseous 
hydrocarbons, cases of local accidents at regularly operated enterprises numbered in the hundreds and thousands cases. 
In particular, there were: 

— 545 cases of depressurization on the main pipelines during the last decade of the XX century; 

— 42 thousand cases of depressurization on the infield pipelines during 2001 alone. 


' Decree of the President of the Russian Federation of December 31, 2015 No. 683 "On the National Security Strategy of the Russian Federation". 
URL: https://www.consultant.ru/document/cons_doc LAW_191669/ (accessed: 02.11.2023). (In Russ.). 

? Decree of the President of the Russian Federation No. 642 of December 01, 2016 "On the Strategy of Scientific and Technological Development of 
the Russian Federation". URL: http://kremlin.ru/acts/bank/41449 (accessed: 02.11.2023). (In Russ.). 

3 Consolidated strategy for the development of the manufacturing industry of the Russian Federation until 2024 and for the period up to 2035. 
Approved by Decree of the Government of the Russian Federation No. 1512-r of June 6, 2020.URL: http://government.ru/docs/39844/ (accessed: 
02.11.2023). (In Russ.). 
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Obviously, only large-scale and costly organized counteraction could solve the problem. 

The world's first successful practice was implemented in Russia in the 50—60s of the XX century in the field of 
safety of heavy-duty liquid-propellant rocket engines for space purposes during development and routine fire tests [5]. It 
is known as the emergency protection system (EPS). 

In the 80s, a similar emergency shutdown system (ESS) was created in the West for general technical facilities. It 
was based on the ALARP principle [6-9], which has been repeatedly refined in Russia and its numerous Russian 
versions? [8-10]. Let us note that the term ALARP originated in the 70s in the field of British legislation on health and 
safety at work, that is, outside the systematic approach. As a result, it retained many characteristic features of that time, 
but exhausted them. 

At the same time, safety policy of oil and gas production and transportation according to the ALARP principle more 
often concerned the procedures for optimizing work processes. This practice was less often applied to the actual 
emergency protection due to the weaker scientific and experimental elaboration of issues related to the relevant 
processes. 

Materials and Methods. The research focused on the problem of creating an EPS production chain of oil and gas 
production and transportation based on the ALARP principle [11-13]. It accompanied the project of creating the 
USNMS NTO, therefore, a comparative analysis of both approaches was carried out in the work. 

As atule, safety problems were solved by the interaction of: 

— the customer (consumer of output products); 

— the contractor (ideologist, developer and manufacturer of output products); 

— the parties involved in the creation of NTO (design organizations and enterprises implementing projects). 

In general, the object of research was an open dissipative dynamic system that combined elements that were 
interdependent and interacted with each other and with the external environment. Two complementary information 
components were taken into account to ensure safety of such NTOs: 

— elements in the NTO (local accidents); 

— NTO as a whole (a complex of interrelated elements, local accidents and systemic disasters). 

A mandatory stage of such work was the coordination of the customer's request and the contractor's capabilities. 

Each component was a set of processes with its own energy and indication. 


Results. It should be emphasized that the study of the NTO elements in itself was not informative enough to 
understand its state as a whole [3-4]. The observability, controllability and safety of the NTO as a system were not 
determined by the characteristics of its constituent elements, even if all of them were taken into account. 

Thus, according to ALARP, the most common cause of accidents and technological disasters was the human factor. 
This does not correspond to the modern point of view [3]. Nevertheless, the ALARP principle has become even more 
widespread in Russia than in the UK. In particular, it was recommended by GOST for risk management®. 

The current situation does not negate doubts about the validity of ALARP. Below are its statements that have caused 
explicit or implicit limitations for qualitative research on the NTO safety. 

1. NTO elements do not interact with each other or their interaction can be neglected. This contradicts the real state 
of affairs. All NTO infrastructures, including oil and gas complexes, are multicomponent, complex dynamic systems. 
They are viable only with a controlled interaction of elements. That is, the fallacy of the statement is easily refuted by 
practice. Why is it not abandoned? The fact is that such an approach justifies simplifying the procedure for summing up 
the risks of the NTO elements in order to obtain an integral risk for the whole object. 

2. The only material carriers and sources of danger to the NTO infrastructure are the elements that form them. The 
statement is true, but only in relation to local type accidents. The rule does not work if we are talking about system 
accidents — catastrophes that are more expensive than the local ones by an average of 4-5 orders of magnitude. 
Catastrophes are multifactorial phenomena. These are the consequences of violations of the normal dynamic interaction 
of the NTO elements with each other, NTO with its own control system, NTO with adjacent equipment, NTO with the 
external environment, etc. 

3. The sources of danger in the NTO elements are statistically mutually independent. This assumption is wrong, first 
of all, in relation to the most severe system accidents — catastrophes that arise due to violations of the interaction of the 
NTO elements. 


> GOST RIEC 61511-3-2011. Functional safety. Safety instrumented systems for the process industry sector. Part 3. Guidelines for the 
determination of the required safety integrity levels. URL: https://docs.cntd.ru/document/1200094220 (accessed: 02.11.2023). (In Russ.). 

® GOST R 54505-2011. Functional safety. Risk management on railway transport. URL: https://docs.cntd.ru/document/1200094215 (accessed: 
02.11.2023). (In Russ.). 
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4. The risk associated with the element has been taken as a measure of the element's danger. Other, more significant 
risks caused by violations of the interaction of elements with each other and with the external environment of the NTO 
are not taken into account. The measure of the NTO danger as a functional unit is determined by the sum of risks of its 
elements [6—11], [14]. It is unacceptable to summarize the risks associated with the NTO elements. And the point is not 
that they usually have different dimensions (with the help of the matrix apparatus of risks, the dimension can be 
excluded [14]), but in the statistical interdependence of the sources of the danger of NTO. According to the ALARP 
scenario, there is no way out of this situation. 

As a result, it is necessary to operate with understated risk indicators compared to their actual values, which means 
underestimating the real dangers for NTO. 

The above allows us to make a number of statements. 

— ALARP suggests following an outdated local approach to solving safety problems of the NTO infrastructure, 
which limits the scope of its application. The situation is aggravated by the failure to mention the unsuitability of 
ALARP for solving problems of system analysis of the state and behavior of the NTO infrastructure. 

— Specialists focused on working on ALARP do not have special tools for the study of the NTO infrastructure itself, 
the development of elements and in general EPS, as well as for the maintenance of the output result of ALARP, etc. Let 
us note that such tools are planned to be developed within the framework of the previously mentioned CSTP. 

— ALARP specialists do not have a technology that can adequately provide the required informativeness, 
manageability and safety of the NTO. 

— Equipping the NTO infrastructure with emergency protection systems based on ALARP does not meet the modern 
vision on the problem of ensuring the safety of NTO. 

Thus, the main weakness of ALARP is the refusal to take into account the dynamic interaction of elements as part of 
the NTO infrastructure. 

Experimental confirmations of the extreme importance of the dynamic interaction of the NTO elements of oil 
and gas fields. The authors of the presented article take the opposite position and have repeatedly received 
confirmation of its validity when conducting research and development work, including conversion, designed to ensure 
man-made safety of civilian facilities, taking into account the experience of space engine building. One of these civilian 
areas has become the extraction and transportation of oil and gas. It is important to note that the authors had unique 
specialized hardware and software resources and technologies (including of their own development). 

Some results of full-scale tests of different standard sizes of NTO were obtained for the first time. To convey these 
results and the accumulated experience, the evidence-based data on the decisive role of the processes of interaction of 
the NTO elements are presented below. They are necessary for the formation of informative components of the NTO 
work processes, and can also be harbingers of large-scale, often spontaneously developing anomalies such as man-made 
disasters [1, 3]. In the real conditions of geographically distributed oil and gas fields, the interactions of elements were 
traced over distances: 

— about 10 m at the facility safety levels; 

—up to 100 m at the workshop levels; 

—up to 10 km at the field level. 

The authors did not conduct research at larger distances between the elements. 

Let us list the constructs of the production links of oil and gas production and transportation, which form the 
dynamic interactions of the elements of the technical control system: 

— energy producing units (combustion chambers, gas generators, cylinders of internal combustion engines, etc.); 

— energy converters (pumps, compressors, turbine units); 

— external and internal bindings of workshops interacting with other links, by-passes, input and output manifolds; 

— energy storage links; 

— wellheads. 

Figures 3—7 in the article are the results of the analysis of the measured parameters of various NTOs infrastructure, 
which were investigated by the Interdepartmental Working Group of the Russian Academy of Sciences represented by 
the authors during field tests. 

Let us start with the most common regular systemic phenomena in the oil and gas industry — self-oscillations 
caused by self-sustaining nonlinear mechanisms of the interaction of the NTO elements with constant (non-oscillatory) 
sources of energy replenishment. In the cases described below, the results from the authors' own experience of 
conducting field tests of oil and gas facilities were used, although the coverage was significantly wider and included 
thermal power plants, hydroelectric power stations, nuclear power plants, production and operation of heavy-duty diesel 
generators, turbo-expanding assemblies (TEA), etc. 
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The main attention was paid to the timely detected incidents, which, thanks to the use of technical means, did not 
develop into accidents and catastrophes. Thus, at the Yuzhno-Russian field of OJSC Severneftegazprom, when fixing a 
powerful self-oscillating process of the dynamic interaction of the pair "ground structure of the well cluster — adjacent 
subsurface", an emergency shutdown of the existing well cluster was triggered (Fig. 1). 


0 20 40 60 80 100 120 140 160 
b) 
Fig. 1. Self-oscillating process of the dynamic interaction of the pair "ground structure of the well cluster — adjacent subsurface ", 
recorded at the Yuzhno-Russian field of OJSC Severneftegazprom: a — wellhead; b — fragment of the vibration parameter of the 


pipe head of the wellhead at the initial moment of self-excitation of powerful natural and man-made self-oscillations with a 
frequency of ~ 200 Hz 


Let us explain that part a) presents the design of the wellhead with a 34-channel system for measuring and recording 
vibration parameters of the 2nd string of the 9th well cluster. The black arrows show the locations of the sensors and the 
measurement directions of the vibration parameters of the structure of the 2nd string of the 9th well cluster, the red 
arrows show the direction of movement of the gas flow. Here, YO is a shut-off device, UB is a measuring unit, BPM is a 
methanol control unit, and YP is a regulating device. 
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The authors of the article had to urgently distract themselves from their main work and take part in clarifying the 
nature of the dangerous phenomenon. As the subsequent calculation and analysis of metal from critical sections 
showed, the fatigue strength of the metal structure was exhausted in the next 2—2.5 hours. 

Additional processing of the measurement results made it possible to establish dislocations of: 

—a constant source of energy replenishment (adjacent bowels of the cluster of wells); 

—a nonlinear oscillatory circuit (cluster of wells). 

The authors have worked out the appropriate methodology, software and hardware in relation to space propulsion. 
At the frequency of excitation of self-oscillations of all pairs of measured vibration parameters of the wellhead, 
coherence almost coincided with unity. 

Figures 2 and 3 present the location and characteristics of the case of self-excitation of self-oscillations. The authors 
recorded it when they conducted full-scale tests of the integrated gas treatment plant (IGTP) at Gazprom Dobycha 
Yamburg LLC (GDYA) in the frequency range of 36-56 Hz (depended on the operating mode). 

The physical mechanism was identified as self-oscillation — a strong dynamic interaction of the gas drying housing 
equipment and its external strapping. The most informative tests turned out to be on transient modes of operation of the 
equipment: 

— slow throttling from 100% of the mode to 65% (in time from 550 seconds to 750 seconds); 

— slow subsequent forcing from 65% of the mode to 85% (in time from 1200 seconds to 1300 seconds). 


Fig. 2. At the integrated gas treatment plant (IGTP-2), a strong nonlinear interaction of dynamic links occurred "gas drying body 
(on the right, in the background) — external binding" 


0 500 1000 1500 
Fig. 3. IGTP-2. Time dependence of the frequency of self-oscillatory interaction of dynamic links "gas drying body — its external 
binding": 1 — according to the processing of the results of field tests; 2 — according to the accompanying theoretical calculation 
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The acceptance tests of the explosion-proof prototype of the disaster response system (DRS) at the GDYA IGTP-2 
in 2006 turned out to be unique in terms of information content and practical physical interpretation of the discovered 
phenomenon. To confirm the experimental reproducibility of the results, 10 similar full-scale tests of IGTP were 
planned in the modes of regular forcing and throttling. The only non-rigid exception, as expected, was the 8th test. Let 
us note that complex systems had different time scales. In the 8th case, in order to obtain a higher time resolution than 
in the previous seven tests, the process gradient was reduced by more than half. 

Due to the exceptional importance of the test results, in addition to regular measurements, the program regulated the 
deployment of a 96-channel geographically distributed system for measuring various parameters of the facility. At the 
automated workplace of the DRS operator in the gas drying building, the parameters were presented after group 
synchronization and centralization (GPS satellite system was used). 

Pronounced bifurcation points in the working processes of the production field (at ~ 18% of the nominal value) 
attracted the attention of the authors long before the acceptance tests. However, this phenomenon had not previously 
caused incidents, so the tests were not canceled. Figure 4 shows the result of graphs overlay of eight of the planned ten 


DRS tests. 
HH 


Bifurcation point 


0 3.6 7.2 10.8 14.4 18.0 21.6 25.2 28.8 


Fig. 4. IGTP-2. The result of eight full-scale tests overlay— graphs of dimensionless amplitude-frequency characteristics and 
relationships of the dynamic system: "inlet — gas cooling housing" — "outlet — pipe casing" at the frequency of self-oscillations 


Here, in the forcing sections, after passing the bifurcation points, the lower branch of the curve was used in tests 1, 
3, 4, 6, and the upper branch was used in tests 2, 5, 7, 8. 

It is clear that the blurriness of the graph in Figure 4 (as well as the graphs in Figures 6, 7 and 8 for other objects) is 
explained not by errors in measuring the NTO parameters, but by overlays of the results of processing data from field 
tests conducted at the same values of the operating parameters of each object. At the same time, the blurriness of the 
graphs is important from the point of view of informativeness. It makes it possible to: 

— clearly present the degree of reproducibility of test results (or other parameters, depending on the formulation of 
the problem), that is, to draw conclusions about the correctness or incorrectness of the problem being solved; 

— take reasonable tolerances for the tasks of making decisions about technical and (or) functional state of the NTO in 
the forms of dependence on the operating parameters of the NTO in the entire range or sub-ranges of values. 

Figure 5 shows a fragment of the processing of the results of the eighth test in the vicinity of the critical point (18% 
of the nominal value) at the throttling site with the spontaneous development of a systemic technogenic accident. At that 
time, there was no gas automation in the cooling and drying housing, so the situation was adjusted manually using a 
bypass. They did not use a conventional emergency stop, but reverse forcing. 
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Fig. 5. IGTP-2. The initial stage of spontaneous development of a systemic disaster 


Experimentally determined post factum, the horizon of the disaster forecast turned out to be unprecedentedly 
large — t*=90 sec at the values of Lyapunov exponents in the areas of excitation and damping of oscillations, 
respectively: A; = + 0.14 Hz and A2 =—0.38 Hz. We have established the reason for such a rare phenomenon in the NTO 
operation. It is due to the discovered (apparently for the first time in world practice) mechanism of a two-stage scenario 
of excitation and development of a catastrophe. At the first step of the previously established critical mode with the 
bifurcation point shown in Figure 4, there was a shop system excitation of a group of production field elements — turbo 
expander units in interaction with an external pipe binding. It also played the role of a trigger mechanism in the second 
step, which was characterized by a strong interaction of the wellheads with the subsurface. 

Subsequently, the development of this general industrial disaster was qualified as the first in the world practice to 
detect in time (which made it possible to take countermeasures) an extremely dangerous regional man-made natural 
earthquake with a magnitude of 6 to 7 points on the Richter scale. The energy source was the subsoil, the constructs of 
the clusters of wells worked as a trigger mechanism. A decisive role was played by manually lowering the throttling 
gradient at the eighth acceptance test and, accordingly, increasing the production field time in the danger zone — in the 
vicinity of the critical bifurcation point at ~ 18% of the nominal value. 

Now it has become a universal practice to detach resonant frequencies from dislocation zones or to accelerate their 
overcoming in transient modes. Examples include space rocket engines, nuclear power plants, hydroelectric power 
plants, aviation equipment, etc. 

Two factors realized during the acceptance tests are of exceptional importance. 

1. A systematic approach to the organization and conduct of DRS tests. Formation of a package of initial 
experimental data to understand the essence of the mechanism and counteract the development of an extremely 
dangerous phenomenon — a general industrial disaster, which geographically and in time coincided with a man-made 
natural earthquake. The local approach peculiar to ALARP and its output products was not in demand in this case. 

2. High information content. The standard system for measuring production field parameters has been 
supplemented. A geographically distributed parameter measurement system with group synchronization and 
centralization of parameters was used. The regularly measured production field parameters indicated the development 
of an emergency: 

—a fraction of a second before its completion, when emergency protection was impossible; 

— only by secondary signs in the high-frequency range (the main events were recorded at low frequencies). 

Figure 6 shows overlays of the results of processing of twelve full-scale tests of turbo-expanding units in the gas 
drying housing of IGTP-2 LLC GDYA during one and a half months of repair. 
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Fig. 6. Experimentally reproducible amplitude-frequency characteristics of the dynamic system "TEA-2 — TEA-7" 


In this case, the authors used a two-channel modular unit for high-precision synchronous isolation of frequency 
components 53F, (53 — the number of turbine blades of the studied standard size of turbo-expanding assemblies) in the 
axial vibration parameters of TEA-2 and TEA-7 turbines. The modes of slow forcing (red curves) and throttling (blue 
curves) of TEA-2 operated. The work was carried out in the nominal normal mode of TEA-7. 

Thus, the amplitude-frequency characteristics of the resonant type (F’pe3 = 3009 Hz) of the potentially dangerous 
high-quality (QO ~ 76.5) dynamic interaction of TEA-2 and TEA-7, reproduced in a wide frequency range up to 
5300 Hz, were evident. It was necessary to develop and implement serious counteraction measures. In addition, 
additional field tests were conducted to confirm their effectiveness. This was a unique case of experimentally 
reproducible system testing of TEA-2 in the modes of starts and stops of its dynamic interaction with an adjacent, 
operating at the nominal mode TEA-7 in a wide frequency range. This experimentally proven approach and the 
technology adequate to it can be used in the operation of any rotary and (or) piston type equipment. It is important to 
keep in mind that formed according to similar characteristics (see Fig. 6) harbingers of development of emergency 
situations at NTOs are systemic. They are suitable for solving problems of identifying the type of developing 
accident — local and systemic (disaster). 

Figures 7 and 8 present experimentally reproducible systemic patterns of interaction between gas pumping units 
(GPU). They were worked out at the Orlovka-2 gas pumping station (Ukraine) and are not fundamentally monitored by 
ALARP-based systems. The total number of field tests according to Fig. 7 (GPU-1 — GPU-2) is 14, according to Fig. 8 
("GPU—4 — GPU-5") is 18. 
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Fig. 7. GPS "Orlovka-2" (Ukraine). Reproducible patterns of interaction "GPU-1 — GPU-2" 
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Fig. 8. GPS "Orlovka-2" (Ukraine). Reproducible patterns of system interaction "GPU-4 — GPU-7" 


In the figures, the patterns are shown in the form of hodographs in the form of dependencies, measured in the 
horizontal and vertical directions of the mean square root values of the vibration velocities of the GPU on the total gas 
flow through the GPS — g. For certainty, the frequency range of measurements of mean square root values of 0.1—5 Hz 
was chosen. According to statistics, it is in this range that processes with a large self-organized concentration of energy 
often occur in NTO structures, which provoke the development of emergency outcomes — both local and more costly 
systemic ones. Despite the significant differences in the physical mechanisms, in this case, the results obtained can be 
used in the operation of rotary-type equipment, and with appropriate adaptation in the operation of non-rotary 
equipment. 

For the development of the above-mentioned prototype of the DRS and the Strategy of the Russian Federation for 
countering the development of systemic accidents [1, 3], are essential: 

— reproducibility of the results of field tests; 

— experimental validity of statistically correct applied results. 

Let us also note the importance of the typical scenario expected by specialists for the development of systemic 
accidents of different physical nature. It took at least ten years of targeted scientific and experimental work to confirm 
the reproducibility of the results. This made it possible to implement in the DRS and then reflect in the Strategy of the 
Russian Federation a set of unified algorithms and technical means for early detection, monitoring and protection 
against all types of man-made accidents. 

An extremely important quality of this complex has been worked out — object orientability (the possibility of deep 
adaptation to almost any standard sizes of the NTO infrastructure). 

We also note a characteristic feature of the system approach, which allows us to draw the right conclusions even if 
the experimental reproducibility of the results of the NTO full-scale tests is weak or not detected at all. It should be 
borne in mind that the same element of a complex system (for example, a compressor) demonstrates different properties 
and behavior, even if it functions as part of a single NTO. It depends on whether the situation is considered before or 
after the repair. This effect is easily confused with poor reproducibility of compressor test results. 

Comparative analysis results of emergency protection systems adequate to the ALARP principle and the 
CSTP system approach. In almost all publications related to the ALARP principle, there are conditions from which 
ALARP proceeds. For some reason, they have to be executed by themselves, and this is a reason for criticism. The 
ALARP principle can be unconditionally used for a class of objects that are collections of such objects that are not 
related to each other, do not interact and are statistically independent. Thus, the usefulness of ALARP is limited to 
individual studies outside the system of each element of the NTO. Also, outside the system, the class of local accidents 
inherent in the elements is considered. The ALARP principle is not suitable for an adequate study of NTO as a whole 
structure, the formation of adequate symptoms, decision-making algorithms, etc. Using any tools based on the ALARP 
ideology (and EPS as well), we must understand that we are going to a conscious restriction. 
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The only way out seems to be the rapid creation of safety systems that are alternative to those that focus on ALARP. 
The foundation for new solutions should be the foundation formed for the implementation of a comprehensive scientific 
and technical program "Creation of innovative software and hardware and technologies to ensure the observability, 
manageability and safety of natural and man-made infrastructure facilities in Russia". 

Here are the main arguments for the readiness to create safety and emergency protection systems within the 
framework of the CSTP as an alternative to the EPS according to the ideology of ALARP. 

— Certified prototypes of professional tools have been created, including in explosion-proof design, for experimental 
testing of components of the system for countering the development of accidents and catastrophes. 

— Emergency protection systems according to the CSTP are based on combined local and systemic approaches to the 
study of the NTO infrastructure within the framework of the theory of self-organized criticality [3]. 

— The emergency protection systems according to the CSTP take into account the discovery of the 50—60s of the 
Russian space engine industry [6]. We are talking about two types of the physical nature of accidents. In modern 
terminology, they are called local (in the NTO elements) and large-scale, systemic (in NTO as an integral functional 
unit). According to the ALARP scheme, the EPS reacts to the development of only low-cost local accidents. 

— Emergency protection systems according to the CSTP are ready to make motivated decisions about the beginning 
of the development of all types of local accidents and systemic accidents in the NTO. This distinguishes them from EPS 
according to the ALARP scheme, which reacts only to local accidents. 

— In the emergency protection systems according to the CSTP, the readiness to transfer the NTO to a safe state has 
been achieved in two scenarios. The first one is the transfer of the NTO to gentle modes of operation. Second: 
emergency shutdown in response to motivated decisions about the development of emergency critical situations. 

— Restrictions on the scope of application of emergency protection systems according to the CSTP according to the 
type of a priori conditions for EPS according to the ALARP scheme have been lifted. 

— In emergency protection systems according to the CSTP, the symptoms of the development of local, systemic 
critical conditions of NTO and the rules for making decisions on the transfer of NTO to a safe state have been 
scientifically and experimentally worked out. 

— Readiness has been achieved (when making an appropriate decision) to work out a high-speed mechanism for 
transferring the NTO to a safe state for the most dangerous explosive-type accidents with a characteristic development 
time At ~ 30-70 ms. 

Discussion and Conclusion. The emergency protection systems developed according to the CSTP "Observability, 
manageability, safety of the NTO infrastructure of Russia" are considered. Their capabilities are evaluated in the 
conditions of the Northwestern region of the Russian Federation [1]. The new approach is compared with the ALARP 
principle, which is widespread in the West and in Russia. 

It is shown that ALARP has outlived its usefulness, since its local orientation does not meet the tasks of system 
monitoring of the IT infrastructure [8—14]. The ALARP approach remained at the level adopted at least 100 years ago, 
in the first half of the twentieth century. This is how it is necessary to evaluate developments implemented under the 
ALARP scheme and their output products, including emergency protection systems [8-14]. 

Research and practice indicate that the ALARP methodology does not provide comprehensive observability, 
manageability, and safety of natural and man-made infrastructure facilities. For this reason, the ALARP-based approach 
does not provide timely, high-quality indication of the development of devastating system crashes — catastrophes. 

Emergency protection systems created according to the proposed CSTP project integrate local and integrated 
approaches to infrastructure monitoring within the framework of the theory of self-organized criticality [3]. 

The prospects of replacing ALARP-based approaches with solutions corresponding to the CSTP are shown. 
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